CVE-2025-14877

Executive Summary

CVE-2025-14877 is a critical SQL injection vulnerability in Campcodes Supplier Management System 1.0. The flaw resides in the /admin/add_retailer.php file, where the cmbAreaCode parameter is directly concatenated into SQL queries without sanitization or parameterization. An unauthenticated remote attacker can exploit this to execute arbitrary SQL commands, potentially leading to full database compromise, data exfiltration, and administrative account takeover. The exploit is publicly available, and while the EPSS score is currently 0.0%, the public availability of exploit code increases the risk of active exploitation. No patch exists, and the vendor has not responded.

Supply Chain & Package Security

This vulnerability is not in a package manager ecosystem (NPM, PyPI, Go, Ruby). It is a standalone PHP application. However, organizations using this system should treat it as a high-risk supply chain component due to the lack of vendor support.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

Threat Level: Critical. The combination of remote exploitability, no authentication required, and public exploit code makes this a high-priority vulnerability for any organization using this software.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the cmbAreaCode parameter within /admin/add_retailer.php. The application likely constructs a SQL query similar to:

INSERT INTO retailers (area_code, ...) VALUES ('$_POST['cmbAreaCode']', ...);

Without input validation or prepared statements, an attacker can inject SQL commands by providing a crafted value for cmbAreaCode. For example:

cmbAreaCode=1' UNION SELECT username,password FROM admin-- -

This would allow the attacker to extract administrator credentials from the database. The injection point is in an INSERT statement, but UNION-based or time-based blind injection can be used to extract data from other tables.

The application is built on PHP and MySQL, making it susceptible to standard SQL injection techniques. The lack of any security controls (CSRF tokens, input sanitization, prepared statements) exacerbates the risk.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

<?php
// /admin/add_retailer.php
$areaCode = $_POST['cmbAreaCode'];
$sql = "INSERT INTO retailers (area_code, name, ...) VALUES ('$areaCode', ...)";
mysqli_query($conn, $sql);
?>

Patched Code (Recommended):

<?php
// /admin/add_retailer.php
$areaCode = $_POST['cmbAreaCode'];
$stmt = $conn->prepare("INSERT INTO retailers (area_code, name, ...) VALUES (?, ...)");
$stmt->bind_param("s", $areaCode);
$stmt->execute();
?>

The patched version uses prepared statements with parameterized queries, which prevents SQL injection by separating SQL logic from user input.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A running instance of Campcodes Supplier Management System 1.0.
• Network access to the /admin/add_retailer.php endpoint.

Exploit Steps:

1. Identify the vulnerable parameter: The cmbAreaCode POST parameter.
2. Craft a malicious payload: Use a UNION-based SQL injection to extract data.

Example Payload (Extracting admin credentials):

POST /admin/add_retailer.php HTTP/1.1
Host: target.com
Content-Type: application/x-www-form-urlencoded

cmbAreaCode=1' UNION SELECT 1,username,password,4,5,6 FROM admin-- -

Automated Exploitation with sqlmap:

sqlmap -u "http://target.com/admin/add_retailer.php" --data="cmbAreaCode=1" --batch --dbs

Expected Outcome: The attacker can enumerate databases, tables, and extract sensitive data such as admin credentials, customer information, and financial records.

Blue Team (Detection & Response)

Detection Steps:

1. Monitor HTTP requests to /admin/add_retailer.php for abnormal cmbAreaCode values containing SQL keywords (UNION, SELECT, OR, AND, --, #).
2. Analyze database logs for unexpected queries or errors originating from the application.
3. Check for outbound data transfers from the database server to unknown IPs.

Response Actions:

1. Immediately isolate the affected server from the network.
2. Review database logs to determine the extent of data exfiltration.
3. Reset all credentials stored in the database.
4. Apply virtual patching via a WAF (e.g., ModSecurity rule to block SQL injection patterns in cmbAreaCode).

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP POST requests to /admin/add_retailer.php with cmbAreaCode containing SQL metacharacters (', ", --, #, UNION, SELECT).
• Unusual database error messages in HTTP responses (e.g., "You have an error in your SQL syntax").
• Outbound connections from the database server to unknown IPs on port 3306 or other ports.

File System IOCs:

• Modified or newly created files in the web root (e.g., webshells like cmd.php).
• Unusual entries in web server access logs (e.g., requests with long cmbAreaCode values).

Log IOCs:

• Database logs showing queries with injected SQL syntax.
• Web server logs showing repeated requests to /admin/add_retailer.php with varying cmbAreaCode values.

Detection Engineering

YARA Rule

rule CVE_2025_14877_SQLi_Detection {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2025-14877 in Campcodes Supplier Management System"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-14877"
    strings:
        $s1 = "cmbAreaCode=" nocase
        $s2 = "UNION" nocase
        $s3 = "SELECT" nocase
        $s4 = "OR " nocase
        $s5 = "1=1" nocase
        $s6 = "--" nocase
        $s7 = "#" nocase
    condition:
        $s1 and (any of ($s2, $s3, $s4, $s5, $s6, $s7))
}

Sigma Rule

title: SQL Injection Attempt Against CVE-2025-14877
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SQL injection attempts targeting the cmbAreaCode parameter in Campcodes Supplier Management System
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains: 
            - "cmbAreaCode="
        cs-uri-query|contains|all:
            - "'"
            - "UNION"
            - "SELECT"
    condition: selection
falsepositives:
    - Legitimate use of single quotes in area codes (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-14877 SQL Injection Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/admin/add_retailer.php"; http_uri; content:"cmbAreaCode="; http_client_body; pcre:"/(\x27|%27).*(UNION|SELECT|OR|AND|--|#)/i"; classtype:web-application-attack; sid:10000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable endpoint /admin/add_retailer.php if not essential.
2. Implement a Web Application Firewall (WAF) rule to block SQL injection patterns in the cmbAreaCode parameter.
3. Restrict network access to the application to trusted IPs only.

Long-Term Fix:

1. Rewrite the code to use prepared statements or parameterized queries for all database interactions.
2. Apply input validation to ensure cmbAreaCode contains only expected characters (e.g., alphanumeric and hyphens).
3. Upgrade to a supported vendor or fork the project and apply security patches.

Vendor Contact:

• Campcodes has not responded to this vulnerability. Organizations should consider migrating away from this unsupported software.

Valters IT signature: This report is provided for authorized security testing and defensive purposes only. Unauthorized exploitation is illegal.